I've heard the
eval() function is vulnerable to SQLi.
Can I check for vulnerabilities by simply viewing the website source code?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Depends what you mean by "source code".
If you use the "view source" function in a web browser, that's not sufficient. That shows you the client side code, while SQLi occurs on the server side.
If you examine the full source code that is running on the server, then yes, examining it can let you find SQLi issues. You can even find SQLI by decompiling executable files if a system is using ASP without source files on the server but fails to protect the compiled files from download.
The typical SQL injection attack can occur when the SQL command string is concatenated to include a user entry:
$sql = "SELECT * FROM users WHERE user_name = '".$user_name."'";
A malicious user could enter a user name like
my name'; DROP TABLE users; --
Guess what happens!
eval() allow you to evaluate code, so yo can have a code injection. Example:
eval("echo 2;"); will print 2 in PHP.
In PHP you also have
shell_exec() where you can execute shell commands.
You can check several types of injection here.
Looking to the website source code is a valid way to check for links to other pages and check what query parameters are used. You can also check forms.
Another way is to check Network tab, to view what information is sent and received by your browser. Try to take a look into Burp Suite, it will help you understand better how to intercept requests and tamper with them to check for some vulnerabilities.